CVE-2008-1198
First published: Thu Feb 28 2008(Updated: )
Description of problem: The default IPSec ifup script (/etc/sysconfig/network-scripts/ifup-ipsec) initializes the racoon configuration to use aggressive IKE mode, then fallback to main IKE mode if that fails: ... remote $DST { exchange_mode aggressive, main; ... Due to widely known attacks, the aggressive mode should be only used when public key authentication is in use. In practice, most administrators use IPSec with PSK authentication, which combined with aggressive mode leads to aforementioned vulnerability. See this whitepaper for more information: <a href="http://www.netsc.ch/IMG/pdf/TargetingIKE_en.pdf">http://www.netsc.ch/IMG/pdf/TargetingIKE_en.pdf</a> The exchange_mode should be changed to "main" only or, for a low-security fallback, to "main, aggressive" (in the opposite order than currently).
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Redhat Enterprise Linux | =5.0 | |
| Redhat Enterprise Linux | =3.0 | |
| Redhat Enterprise Linux | =4.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.ernw.de/download/pskattack.pdf
- https://bugzilla.redhat.com/show_bug.cgi?id=435274
- http://www.securitytracker.com/id?1019563
- https://exchange.xforce.ibmcloud.com/vulnerabilities/41053
- http://secunia.com/advisories/48045
- http://www.netsc.ch/IMG/pdf/TargetingIKE_en.pdf
- http://ikecrack.sourceforge.net
- https://rhn.redhat.com/errata/RHSA-2012-0312.html
- collector/nvd-historical
- collector/nvd-index
- agent/type
- agent/softwarecombine
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/author
- agent/references
- agent/severity
- agent/weakness
- agent/description
- agent/event
- agent/tags
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2008-1198
- vendor/redhat
- canonical/redhat enterprise linux
- version/redhat enterprise linux/5.0
- version/redhat enterprise linux/3.0
- version/redhat enterprise linux/4.0